Unpacking the Cyber Security and Data Protection Bill

Khumbulani Vodloza Sibanda
Since its crafting in 2016, the Cyber Security and Data Protection Bill has drawn the attention of most anti-Government elements who have been criticising it as meant to stifle, the people’s constitutionally-assured right to expression through various internet-based platforms.

Others have concentrated so much on what they perceive as the downsides of the law to the total exclusion of the benefits of the Bill to society in general.

The Bill is, however, not just about monitoring and bringing to book internet social misfits and outright criminals who thrive on propagating fake news and causing mayhem in the country. It is also about increasing cyber security and building confidence and trust in the secure use of information communication technologies (ICTs).

According to the Bill, its aim is “to consolidate cyber related offences and provide for data protection with due regard to the Declaration of Rights under the Constitution and the public and national interest, to establish a Cyber Security Centre and a Data Protection Authority, to provide for their functions, provide for investigation and collection of evidence of cybercrime and unauthorised data collection and breaches, and to provide for admissibility of electronic evidence for such offences.” The proposed law’s other thrust is to create a technology driven business environment and encourage technological development and the lawful use of technology.

The crafting of the Bill came against a background of the need to regulate and police data breaches such as hacking, electronic transactions and commerce as well as fighting cybercrimes. There had been efforts to address these concerns by the drafting of the Data Protection Bill, the Electronic Transactions and Electronic Commerce Bill and the Computer Crime and Cybercrimes Bill. While these efforts were noble and spot on, there was need to consolidate them into a single and solid piece of legislation, hence, the drafting of the Cyber Security and Data

Protection Bill. At the time of writing this article, the Bill had been gazetted on 15 May 2020 as it makes its way towards Presidential assent.

In order to operationalise the proposed legislation, the Bill proposes the establishment of a Cyber Security Centre and the designation of the Postal and Telecommunications Regulatory Authority of Zimbabwe (Potraz) as the Cyber Security Centre. The Centre’s roles include advising Government and implementing its policies on cybercrime and cybersecurity, identifying areas for interventions to prevent cybercrime, co-ordinating cybersecurity and establishing a national contact point available daily around the clock as well as to establish and operate, a protection-assured whistle-blower system to facilitate the reporting of suspected crime to the Committee among others. The Centre is also expected to submit annual reports on its activities to the responsible Minister, which, would enhance the Centre’s transparency as it would be tabled before Parliament.

The Bill also proposes the formation of a Data Protection Authority and the designation of Potraz as the Data Protection Authority (DPA).

The roles of the DPA include the regulating, the manner in which personal information may be processed through the establishment of conditions for the lawful processing of data, promoting and enforcing fair processing of data in accordance with the Act, advising the minister on matters relating to right to privacy and access, conducting inquiries or investigations for its own purposes, in assistance of other parties or in response to complaints.

Contrary to the internet use suppression narrative being peddled by the Bill’s critics, the legislation is not just about Government but, about all Zimbabweans. For example, Part 1 Clauses 163 to 163E of the Bill deals with hacking and prevention of interference with and impairment of the functions of a computer system. It also deals with the security and protection of data on computers so that data is not obtained, installed, downloaded or modified illegally. This safeguards the operations of most organisations and business entities.

The law would come in handy in dealing with cases such as the one where a university student hacked into the institution’s examination database and forged his results in February this year. Once the Bill is enacted into law, such offenders would be sentenced to 10-year prison terms, thereby protecting the integrity of the country’s prized education system.

The proposed law is also meant to enhance civil aviation safety, deal with drug dealing and the obstruction the course of justice. Part 1 Clause 163 of the Bill indicates that “an offence is committed in aggravating circumstances” if someone interferes with computers and data without authority with the intention to damage, destroy or prejudice the safe operation of aircraft. Similarly, those who defeat the course of justice, conceal proceeds of crimes such as drug dealing or causes economic losses using computers and computer systems are also guilty of an offence.

The law seeks to deal with the perpetration of social vices such as racism and xenophobia. Clause 164F deals with the production and dissemination of racist and xenophobic material as the use of language that tends to lower the reputation or feelings of people that they belong to an inferior race or country of origin.

The proposed Bill seeks to ensure peace and national security. It aims to tackle the increasing vice of the incitement of the youth by anti-Government elements like one who recently called for the “total removal of Zanu-PF from power” using a local online publication. While opposition parties are well within their rights to contest for State power, doing so by using electronic communications formats such as viral videos to incite their members to be violent and damage property is a criminal offence under the Bill. The same applies to the case of the yet-to-be-identified gentleman who was featured in a video which went viral two or months back threatening unspecified action against President Mnangagwa.

Since the introduction of electronic commerce via automated teller machines, swipe debit cards and the use of mobile money over the course of the last two decades, no law was enacted to regulate electronic commerce and tackle crimes that would be committed using these means.

The Electronic Transactions and Electronic Commerce Bill was consolidated into the Cyber Security and Data Protection Bill, before it reached the Presidential assent stage. The proposed law therefore seeks to deal with this gap in legislation.

This will deal with cyber-fraud, cyber-forgery computer-related financial offences, violation of intellectual property rights, identity-related offences and cyber-extortion. As the adoption of ICTs increases, so will be the need for effective legislation to deal with criminal offences arising therefrom. Sound legislation on electronic commerce enhances prospective investors’ confidence in Zimbabwe as an investment destination.

One of the threats to global peace is the scourge of terrorism and sabotage. This is worsened by the spread and facilitation by perpetrators who use ICTs for purposes of recruiting and spreading their cause. As the take up of ICTs increases in Zimbabwe so does the threat of their abuse by some rogue citizens for cyber-related and terrorism purposes in pursuit of objectives such as secession or opposition politics. The proposed legislation is also aimed at dealing with such an eventuality.

In addition to the foregoing, the Bill seeks to deal with ICT-facilitated social crimes such as child pornography.

The Cyber Security and Data Protection Bill also articulates ICT sector players’ obligations under the proposed law. These include removing certain content from its servers after receiving an order to do so in line with the law’s Subsection 3. It also criminalises the provision of access to, storage of or transmission to any information when fully aware of its unlawfulness.